Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 72

Export CSV
CVE-2022-44455

The appspawn and nwebspawn services were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.

The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. An unprivileged malicious application would be able to gain code execution within any application installed on the device or cause application crash.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Openatom Openharmony
Products
Openharmony Openharmony
CVE-2022-43451

Multiple path traversal in appspawn and nwebspawn services.

OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary directories or escape application sandbox.If chained with other vulnerabilities it would allow an unprivileged process to gain full root privileges.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Openharmony
Products
Openharmony
CVE-2022-41802

Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres.

Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes padding data from kernel stack are copied to user space incorrectly and leaked.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Openatom Openharmony
Products
Openharmony Openharmony
CVE-2022-38701

IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.

OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Openatom Openharmony
Products
Openharmony Openharmony
CVE-2022-38700

multimedia subsystem has a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.

OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Openharmony
Products
Openharmony
CVE-2022-38081

Tokensync in security subsystem has a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.

OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Openharmony
Products
Openharmony
CVE-2022-38064

windowmanager in window subsystem has a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.

OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Openharmony
Products
Openharmony
CVE-2022-36423

Incorrect configuration of the cJSON library lead a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.

OpenHarmony-v3.1.2 and prior versions have an incorrect configuration of the cJSON library, which leads a Stack overflow vulnerability during recursive parsing. LAN attackers can lead a DoS attack to all network devices.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Openatom Openharmony
Products
Openharmony Openharmony
CVE-2024-41160

Liteos-A has an use after free vulnerability

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Openatom Openharmony
Products
Openharmony Openharmony
CVE-2024-38386

Arkcompiler Ets Runtime has an out-of-bounds write vulnerability

in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Openatom Openharmony
Products
Openharmony Openharmony
CVE-2024-39816

Arkcompiler Ets Runtime has an out-of-bounds write vulnerability

in OpenHarmony v4.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Openatom Openharmony
Products
Openharmony Openharmony
CVE-2024-41157

Liteos-A has an use after free vulnerability

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Openatom Openharmony
Products
Openharmony Openharmony